From ef35a3330083b1f2f8ba0b093fa496a9e701e85f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Voet=20=28ryv=29?= <ryv@odoo.com>
Date: Thu, 7 Jul 2022 11:31:54 +0000
Subject: [PATCH] [FIX] web: never cache the CSRF token

"website.layout" inherit of "portal.frontend_layout" which inherit of
"web.layout" which contains the creation of the CSRF token.
Add because "website.layout" add a t-cache key, the CSRF token is under
this cache key. But the CSRF token should be always generated,
then add t-nocache on CSRF token t-set.

Part-of: odoo/odoo#95755
---
 addons/web/views/webclient_templates.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/views/webclient_templates.xml b/addons/web/views/webclient_templates.xml
index 44ac56ea092..97dd75ca02d 100644
--- a/addons/web/views/webclient_templates.xml
+++ b/addons/web/views/webclient_templates.xml
@@ -15,7 +15,7 @@
         <link type="image/x-icon" rel="shortcut icon" t-att-href="x_icon or '/web/static/img/favicon.ico'"/>
         <script id="web.layout.odooscript" type="text/javascript">
             var odoo = {
-                csrf_token: "<t t-esc="request.csrf_token(None)"/>",
+                csrf_token: "<t t-nocache="The csrf token must always be up to date." t-esc="request.csrf_token(None)"/>",
                 debug: "<t t-esc="debug"/>",
             };
         </script>